Case study · Aug 2026

UpConduit: a global monitoring SaaS, idea to revenue-ready in 48 hours

Uptime and email-infrastructure monitoring from a seven-region probe network — with accounts, live Stripe billing, branded alerts, public status pages and a world map. I entered a deliberately crowded market partly as a test: how much faster is a second platform when the patterns from the first are already proven? The honest answer surprised me — two days.

01The brief I set myself

Uptime monitoring is a commodity market — dozens of vendors will ping your website. That was partly the point: a crowded market is a fair benchmark. The differentiator came from my own background: twenty years of running email infrastructure taught me that a website going down is loud, but email breaking is silent. A missing DKIM key, a botched SPF edit, a domain quietly landing on a blocklist — nothing crashes, nobody calls, your mail just stops arriving. UpConduit monitors that layer too: MX, SPF, DKIM, DMARC policy strength, blocklists, and drift — alerting the moment records change, even when the new values look valid.

02Constraints first

• One operator, seven regions. The fleet must run itself: serverless everywhere, one source of truth, nothing to patch.
• Alerts must not cry wolf. A monitoring product lives or dies on trust in its silence. One network blip must never page anyone; seven regions must never send the same bad news seven times.
• Honest by design. No fabricated metrics, no fake "checking…" theatre — and when a data source can't be trusted or reached, the product must say so rather than guess.
• Commodity price, real margins. Checks every minute from every region had to cost pennies, so the free tier is genuinely free and £9/month is genuinely profitable.

03The architecture

Seven Lambda probes — London, Virginia, Oregon, São Paulo, Singapore, Sydney, Tokyo — each fire once a minute on EventBridge schedules and write latency snapshots into a single DynamoDB table in London. Only the London primary owns state: it runs the flap-resistant up/down state machine, the staged certificate and domain-expiry ladders, the drift detection, and every alert. The other six measure and report; they never judge. That one decision eliminates duplicate alerts and cross-region races outright.

04Deep dive: alerts that don't cry wolf

Trust is the entire product. Every design choice bends toward quiet correctness: DOWN requires consecutive confirmed failures, recovery alerts exactly once, certificate and domain expiry climb staged ladders (30/15/7 and 60/30/14/7 days) that fire once per rung instead of nagging daily, and page-worthy events are separated from advisory ones — SMS only ever carries downtime and recovery.

Drift detection needed the same discipline. Mail records are fingerprinted so an unexpected change alerts immediately — but the fingerprint deliberately excludes things that change legitimately: DKIM providers rotate which key is live as routine hygiene, so the fingerprint tracks the shape of the configuration, not the key material. Name-server changes — the classic hijack signature — alert with the new servers named, but a domain renewal never fires it. Getting these boundaries right is the difference between an alert someone reads at 2am and one they unsubscribe from.

05Deep dive: never trust a clean you can't validate

Blocklist monitoring has a trap most tools fall into: DNS blocklists refuse queries from shared resolvers, and the refusal is byte-for-byte identical to "not listed". A naive checker reports every domain clean forever and is never caught. UpConduit queries each list's guaranteed-listed test entry alongside every real check — if the canary doesn't come back listed, that list's answers are discarded and reported as unavailable rather than trusted.

06Deep dive: the commercial layer

• Accounts: Cognito email sign-up, verification codes and password reset — delivered as branded email through the product's own DKIM-signed, DMARC-enforcing domain, because an email-health product should hold its own email to the standard it checks others against.
• Billing: Stripe Checkout and customer portal with webhook-driven entitlements — signature-verified by hand, dependency-free. Free tier (10 monitors) to Pro (100 monitors + SMS) is one webhook event.
• Heartbeats: inverse monitoring for cron jobs and backups — the customer's script pings a secret URL and silence becomes the alert. Captures a whole audience that "we ping your website" tools miss.
• Status pages: free for everyone, on purpose — every public page a customer shares carries "Monitored by UpConduit" to their audience. The growth loop is the feature.

07Outcomes

08Decisions I'd defend in an interview

Measure everywhere, judge in one place.

Probes report; one region owns truth and alerting. Distributed reads, centralised judgement — most cross-region complexity never gets the chance to exist.

Enter the crowded market on purpose.

Commodity uptime checks earn the right to sell the differentiated thing: email-infrastructure health, where my years of email-infrastructure work could genuinely add something.

Give away the growth loop.

Status pages are free on every plan because each one is an advert a customer publishes for us. Charging for it would be pricing the marketing.

Admit what you can't see.

Canary-validated blocklists, "expiry unknown" with reasons, no fake data anywhere. In monitoring, honesty is not a virtue — it's the specification.

09Why 48 hours was possible

Very little here was invented in those two days. Every pattern was proven once already on CaseConduit — serverless chokepoints, webhook-driven Stripe entitlements, Cognito flows, incident-tested deployment discipline — and built with Anthropic's Claude as the force multiplier, directed by the architecture, constraints and failure-mode thinking that twenty years of infrastructure work provides. The first platform took eight months and plenty of wrong turns; the second was mostly those lessons paying off.